Malicious HTTP traffic detection system and method based on deep learning

Abstract

The invention discloses a malicious HTTP (Hyper Text Transport Protocol) traffic detection system and method based on deep learning, and relates to the technical field of information security, the malicious HTTP traffic detection system comprises a domain segmentation module, an active label correction module and a multi-domain feature extraction module, and the domain segmentation module segmentsdifferent types of fields into a unified format with a specific method for domain segmentation; an active label correction algorithm of the active label correction module is used for correcting the label and storing the corrected label into a database; the multi-domain feature extraction module is used for mining a deep relationship between different types of domains in the HTTP protocol; training and learning are carried out through data obtained by the active label correction module; through the implementation of the scheme, the problem of how to describe the HTTP traffic by utilizing fieldinteraction and selecting effective fields is solved, the negative influence of invalid information is reduced, the most important field is highlighted, and meanwhile, the interpretability of the framework is also improved.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a system and method for detecting malicious HTTP traffic based on deep learning. Background technique [0002] Hypertext Transfer Protocol (HTTP) is the primary protocol for implementing desktop and mobile websites and applications. Due to the popularity and wide application of HTTP, which makes it easier for attackers to hide in a large amount of HTTP traffic, it has become the main medium of illegal activities. [0003] Existing malicious HTTP traffic detection methods can be broadly classified into two categories according to how features are designed: (1) Manually designed methods: detect anomalies using statistics-based multi-domain correlation feature sets. To exploit structural information, Rafiqu designs a message tree to generate signatures from malicious traffic only by a cluster-based approach. Richard passively generates fingerprints extracted f...

AI Technical Summary

Problems solved by technology

(2) Automatic learning methods: Compared with URLs, network traffic data also suffer from unavoidable difficulties of label noise and non-stationarity, making the self-learning function vulnerable to labels

Second, for existing self-learning functions, even for most manually designed functions, only focus on single field or multi-field content, the underlying triggering relationship between fields (such as the relationship between URL and reference, version and method) not taken seriously

Images